diff --git a/backend/cmd/app.go b/backend/cmd/app.go
index 81e8964a..95dd041e 100644
--- a/backend/cmd/app.go
+++ b/backend/cmd/app.go
@@ -39,8 +39,6 @@ import (
 )
 
 // newWaveletApp creates a core.App wired with Wavelet platform infrastructure, domain plugins, and profile drivers.
-//
-//nolint:contextcheck
 func newWaveletApp(profile core.Profile) *core.App {
 	app := core.NewApp(
 		core.WithProfile(profile),
diff --git a/backend/cmd/banner.go b/backend/cmd/banner.go
index 21bde4ec..df0e044d 100644
--- a/backend/cmd/banner.go
+++ b/backend/cmd/banner.go
@@ -2,8 +2,6 @@
 // SPDX-License-Identifier: Apache-2.0
 
 // Package cmd provides CLI command entry points.
-//
-//nolint:unused
 package cmd
 
 import (
@@ -14,7 +12,7 @@ import (
 	"strings"
 )
 
-//nolint:unused // startup banner formatting utilities
+// startup banner formatting utilities
 type startupState struct {
 	mode           string
 	listensForHTTP bool
diff --git a/backend/core/app.go b/backend/core/app.go
index c4bd75b0..afa40d5d 100644
--- a/backend/core/app.go
+++ b/backend/core/app.go
@@ -303,8 +303,6 @@ func (a *App) RunMigrations() error {
 // 2. Dispatches database migrations via MigrationEngine.
 // 3. Filters and starts drivers matching the active Profile.
 // 4. Emits "app:ready" on the EventBus.
-//
-//nolint:contextcheck
 func (a *App) Start(ctx ...context.Context) error {
 	a.mu.Lock()
 	if a.running {
@@ -386,8 +384,6 @@ func (a *App) Start(ctx ...context.Context) error {
 // 2. Stops all started drivers in LIFO (reverse) order.
 // 3. Disposes the Context (running registered OnDispose callbacks in LIFO order).
 // 4. Emits "app:stopped" on the EventBus.
-//
-//nolint:contextcheck
 func (a *App) Stop(ctx ...context.Context) error {
 	a.mu.Lock()
 	if !a.running {
@@ -448,7 +444,7 @@ func (a *App) Stop(ctx ...context.Context) error {
 // Run starts the application and blocks until an OS signal (SIGINT, SIGTERM) or context cancellation is received,
 // then executes graceful shutdown.
 //
-//nolint:contextcheck
+//nolint:contextcheck // Run forwards a sigCtx derived from the caller's context to Start; the rule cannot follow the variadic parameter
 func (a *App) Run(ctx ...context.Context) error {
 	var parent context.Context
 	switch {
@@ -505,8 +501,6 @@ func (a *App) ExecuteCLI(args ...string) error {
 }
 
 // ExecuteCLIWithContext parses CLI arguments, configures the profile, and runs the application with the given context.
-//
-//nolint:contextcheck
 func (a *App) ExecuteCLIWithContext(ctx context.Context, args ...string) error {
 	cliArgs := args
 	if len(cliArgs) == 0 {
diff --git a/backend/plugins/domain/admin/repository/db.go b/backend/plugins/domain/admin/repository/db.go
index bd83c9e5..24707747 100644
--- a/backend/plugins/domain/admin/repository/db.go
+++ b/backend/plugins/domain/admin/repository/db.go
@@ -327,7 +327,7 @@ func GetPostgresInfo(ctx context.Context) model.DatabaseInfoResponse {
 
 // OpenSQLiteExportFile opens the active SQLite database file together with its stat info.
 func OpenSQLiteExportFile() (*os.File, os.FileInfo, error) {
-	//nolint:gosec // export db file path is trusted
+	// export db file path is trusted
 	f, err := os.Open(sqliteDatabasePath())
 	if err != nil {
 		return nil, nil, fmt.Errorf("%s: %w", errs.ErrOpenDatabaseFileFailed, err)
diff --git a/backend/plugins/domain/cap/pow/prng.go b/backend/plugins/domain/cap/pow/prng.go
index e6ebf263..5f8e424a 100644
--- a/backend/plugins/domain/cap/pow/prng.go
+++ b/backend/plugins/domain/cap/pow/prng.go
@@ -10,7 +10,7 @@ import (
 
 // fnv1a returns the 32-bit FNV-1a hash of a string
 //
-//nolint:mnd // FNV-1a 算法位移常量
+// FNV-1a 算法位移常量
 func fnv1a(str string) uint32 {
 	var hash uint32 = 2166136261
 	for i := 0; i < len(str); i++ {
@@ -22,7 +22,7 @@ func fnv1a(str string) uint32 {
 
 // fnv1aResume resumes FNV-1a hashing from a given state
 //
-//nolint:mnd // FNV-1a 算法位移常量
+// FNV-1a 算法位移常量
 func fnv1aResume(state uint32, str string) uint32 {
 	h := state
 	for i := 0; i < len(str); i++ {
@@ -33,15 +33,13 @@ func fnv1aResume(state uint32, str string) uint32 {
 }
 
 // hashShift computes FNV-1a mix additions
-//
-//nolint:mnd
 func hashShift(h uint32) uint32 {
 	return (h << 1) + (h << 4) + (h << 7) + (h << 8) + (h << 24)
 }
 
 // prngFromHash generates a hex string of specified length using an initial hash state
 //
-//nolint:mnd // xorshift 算法位移常量
+// xorshift 算法位移常量
 func prngFromHash(initialHash uint32, length int) string {
 	state := initialHash
 	var result strings.Builder
diff --git a/backend/plugins/domain/message_gateway/push/custom.go b/backend/plugins/domain/message_gateway/push/custom.go
index 18a47228..942bc183 100644
--- a/backend/plugins/domain/message_gateway/push/custom.go
+++ b/backend/plugins/domain/message_gateway/push/custom.go
@@ -68,7 +68,7 @@ func (p *CustomPusher) Send(ctx context.Context, cfg Config, _ string, body map[
 	bodyBytes, _ := io.ReadAll(io.LimitReader(resp.Body, maxCustomResponseBytes))
 	upstreamResp := strings.TrimSpace(string(bodyBytes))
 
-	if resp.StatusCode < 200 || resp.StatusCode >= 300 { //nolint:mnd
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
 		return upstreamResp, fmt.Errorf("custom: http status %s", resp.Status)
 	}
 
diff --git a/backend/plugins/domain/message_gateway/push/telegram.go b/backend/plugins/domain/message_gateway/push/telegram.go
index 3772808e..68f6ba12 100644
--- a/backend/plugins/domain/message_gateway/push/telegram.go
+++ b/backend/plugins/domain/message_gateway/push/telegram.go
@@ -34,8 +34,6 @@ type telegramErrorResponse struct {
 }
 
 // Send 执行 Telegram 消息发送
-//
-//nolint:cyclop
 func (p *TelegramPusher) Send(ctx context.Context, cfg Config, target string, body map[string]any, template string, _ map[string]any) (string, error) {
 	if cfg.Secret == "" {
 		return "", errors.New("telegram: Bot Token (Secret) is required")
diff --git a/backend/plugins/domain/message_gateway/service/push.go b/backend/plugins/domain/message_gateway/service/push.go
index ddcc36eb..c7e60b7f 100644
--- a/backend/plugins/domain/message_gateway/service/push.go
+++ b/backend/plugins/domain/message_gateway/service/push.go
@@ -899,8 +899,6 @@ type EventTrigger struct{}
 var DefaultTrigger = &EventTrigger{}
 
 // Trigger receives event metadata and processes the event notification dispatch asynchronously.
-//
-//nolint:contextcheck
 func (t *EventTrigger) Trigger(ctx context.Context, meta model.EventMetadata, body map[string]any) {
 	asyncCtx := context.WithoutCancel(ctx)
 	util.Go(func() {
diff --git a/backend/plugins/domain/upload/handler/routers.go b/backend/plugins/domain/upload/handler/routers.go
index 067254ba..a02f5141 100644
--- a/backend/plugins/domain/upload/handler/routers.go
+++ b/backend/plugins/domain/upload/handler/routers.go
@@ -55,8 +55,6 @@ type batchDownloadRequest struct {
 // @Failure 401 {object} response.Any "未登录"
 // @Failure 500 {object} response.Any "内部错误"
 // @Router /api/v1/upload [post]
-//
-//nolint:revive
 func UploadFile(c *gin.Context) {
 	c.Header("X-Content-Type-Options", "nosniff")
 	c.Header("Content-Security-Policy", "sandbox")
diff --git a/backend/plugins/domain/upload/task/storage_migration.go b/backend/plugins/domain/upload/task/storage_migration.go
index eca6098b..1697305a 100644
--- a/backend/plugins/domain/upload/task/storage_migration.go
+++ b/backend/plugins/domain/upload/task/storage_migration.go
@@ -108,7 +108,6 @@ func (h *MigrationHandler) Execute(ctx context.Context, payload []byte) (*contra
 			_ = cache.Delete(cleanupCtx, lockKey)
 		}()
 
-		//nolint:contextcheck,gosec
 		util.Go(func() {
 			ticker := time.NewTicker(renewalInterval)
 			defer ticker.Stop()
@@ -116,6 +115,7 @@ func (h *MigrationHandler) Execute(ctx context.Context, payload []byte) (*contra
 				select {
 				case <-ticker.C:
 					renewCtx, cancel := context.WithTimeout(context.Background(), cleanupTimeout)
+					//nolint:contextcheck // renewal must carry its own deadline; the task context may already be canceled
 					_ = cache.Set(renewCtx, lockKey, "locked", time.Hour)
 					cancel()
 				case <-stopRenewal:
diff --git a/backend/plugins/domain/user/errs.go b/backend/plugins/domain/user/errs.go
index b09fb3e9..df4102f2 100644
--- a/backend/plugins/domain/user/errs.go
+++ b/backend/plugins/domain/user/errs.go
@@ -20,7 +20,7 @@ const (
 	errPasswordEncryptFailed = "密码加密失败"
 	//nolint:gosec // error message, not hardcoded credentials
 	errPasswordUpdateFailed = "密码更新失败"
-	//nolint:gosec // error message, not hardcoded credentials
+	// error message, not hardcoded credentials
 	errPasswordEmpty = "password cannot be empty"
 )
 
@@ -35,7 +35,7 @@ const (
 	errAdminCannotDelete    = "管理员账号无法被删除"
 	errCannotDeleteSelf     = "不能删除当前登录用户"
 	errServiceUsernameEmpty = "user: username cannot be empty"
-	//nolint:gosec // error message, not hardcoded credentials
+	// error message, not hardcoded credentials
 	errServiceOldPasswordIncorrect = "user: incorrect old password"
 	//nolint:gosec // error message, not hardcoded credentials
 	errServicePasswordTooShort = "密码长度至少为 8 位"
diff --git a/backend/plugins/drivers/driver_asynq_worker/handler.go b/backend/plugins/drivers/driver_asynq_worker/handler.go
index 92c5c554..92724fd9 100644
--- a/backend/plugins/drivers/driver_asynq_worker/handler.go
+++ b/backend/plugins/drivers/driver_asynq_worker/handler.go
@@ -7,7 +7,7 @@ import "context"
 
 // TaskResult 任务执行结果
 //
-//nolint:revive // TaskResult 保留完整名称以避免与通用 Result 混淆
+// TaskResult 保留完整名称以避免与通用 Result 混淆
 type TaskResult struct {
 	Message string // 结果摘要，如 "共清理 120 个文件，耗时 3.2s"
 	Detail  string // 可选的详细结果 JSON
@@ -26,7 +26,7 @@ type PayloadValidator interface {
 // 开发者只需实现 Execute 方法编写业务逻辑，在方法内通过 driver_asynq_worker.AppendLog(ctx, ...) 追加执行日志。
 // 任务的创建、状态更新、错误记录、重试计数全部由框架透明处理。
 //
-//nolint:revive // TaskHandler 保留完整名称以避免与通用 Handler 混淆
+// TaskHandler 保留完整名称以避免与通用 Handler 混淆
 type TaskHandler interface {
 	// Execute 执行任务业务逻辑
 	//   - ctx: 已注入 Trace Span 和 taskID 的上下文
diff --git a/backend/plugins/drivers/driver_asynq_worker/meta.go b/backend/plugins/drivers/driver_asynq_worker/meta.go
index 39fb85b5..7dfbfdf7 100644
--- a/backend/plugins/drivers/driver_asynq_worker/meta.go
+++ b/backend/plugins/drivers/driver_asynq_worker/meta.go
@@ -10,7 +10,7 @@ import (
 
 // TaskParam 任务参数定义
 //
-//nolint:revive // TaskParam 保留完整名称以避免与通用 Param 混淆
+// TaskParam 保留完整名称以避免与通用 Param 混淆
 type TaskParam struct {
 	Name        string `json:"name"`        // 参数键名
 	Label       string `json:"label"`       // 显示名称
@@ -22,7 +22,7 @@ type TaskParam struct {
 
 // TaskMeta 任务元数据
 //
-//nolint:revive // TaskMeta 保留完整名称以避免与通用 Meta 混淆
+// TaskMeta 保留完整名称以避免与通用 Meta 混淆
 type TaskMeta struct {
 	Type         string      `json:"type"`
 	AsynqTask    string      `json:"asynq_task"`
diff --git a/backend/plugins/drivers/driver_asynq_worker/types.go b/backend/plugins/drivers/driver_asynq_worker/types.go
index 7d4ebc44..23435faa 100644
--- a/backend/plugins/drivers/driver_asynq_worker/types.go
+++ b/backend/plugins/drivers/driver_asynq_worker/types.go
@@ -12,8 +12,6 @@ import (
 )
 
 // TaskExecutionStatus 任务执行状态
-//
-//nolint:revive
 type TaskExecutionStatus string
 
 // Task execution status constants.
@@ -25,8 +23,6 @@ const (
 )
 
 // TaskExecution 任务执行记录
-//
-//nolint:revive
 type TaskExecution struct {
 	ID           uint64              `json:"id,string" gorm:"primaryKey"`
 	TaskID       string              `json:"task_id" gorm:"size:128;uniqueIndex;not null"`
@@ -92,8 +88,6 @@ func GetLatestTaskExecutionByTaskType(ctx context.Context, taskType string) (*Ta
 }
 
 // TaskExecutionCleanupStats describes task execution log cleanup results.
-//
-//nolint:revive
 type TaskExecutionCleanupStats struct {
 	HighFrequencyDeleted int64
 	LowFrequencyDeleted  int64